🕵️ cook.pth
Named by 11 kept items in this workspace.
9 items name it under classification.key entities and 2 under threat actors.
Search every workspace for cook.pth. It matches the name as written, so it can find other things that share it.
The items that name it 11
writeupas classification.key entities2026-10-23
threadas threat actors2026-10-22It is written here as cook.pth (credential-stealing payload in LiteLLM 1.107.0, delivered as a .pth file that runs when Python starts).
credential-stealing payload in LiteLLM 1.107.0, delivered as a .pth file that runs when Python starts
threadas threat actors2026-10-22It is written here as cook.pth (malicious .pth file dropped by the wheels so "import cook" runs at every Python startup).
malicious .pth file dropped by the wheels so "import cook" runs at every Python startup
writeupas classification.key entities2026-10-21
threadas classification.key entities2026-10-21
writeupas classification.key entities2026-10-21
writeupas classification.key entities2026-10-21
writeupas classification.key entities2026-10-21
writeupas classification.key entities2026-10-21
writeupas classification.key entities2026-10-21
writeupas classification.key entities2026-10-21
All threat actors in this workspace.